CVE-2026-45787 Details
Description
electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.9.5, deterministic AES-192-CBC with a fixed zero IV, constant KDF salt, and no MAC leads to confidentiality and integrity failures for synced bookmark/profile data. Attackers can crack common passwords across installs and perform undetected ciphertext bit-flips to alter config/bookmarks. This vulnerability is fixed in 3.9.5.
A vulnerability exists in Electerm versions prior to 3.9.5, where the encryption method used for syncing bookmark and profile data is insecure. The application employs deterministic AES-192-CBC encryption with a fixed zero initialization vector (IV), a constant key derivation function (KDF) salt, and no message authentication code (MAC). This flaw allows attackers to decrypt data by cracking common passwords used across different installations and to manipulate configuration or bookmark data by undetected bit-flipping of the ciphertext.
Users can upgrade to Electerm version 3.9.5 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-326 | Inadequate Encryption Strength | [email protected] |
| CWE-329 | Generation of Predictable IV with CBC Mode | [email protected] |
| CWE-353 | Missing Support for Integrity Check | [email protected] |
| CWE-759 | Use of a One-Way Hash without a Salt | [email protected] |
| CWE-916 | Use of Password Hash With Insufficient Computational Effort | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| electerm project electerm | < 3.9.5 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 3, 2026 | Initial Analysis | [email protected] |
| May 28, 2026 | New CVE Received | [email protected] |